A Real-Time Packet Burst Metric TERENA Networking Conference 2004 Klaus Mochalski Computer Science Department University of Leipzig, Germany Jörg Micheel NLANR Measurement and Network Analysis Group San Diego Supercomputer Center University of California San Diego, USA

Objective and Motivation QoS-aware measurement of network link utilization on a small time scale with respect to different traffic profiles (burstiness) to provide useful data to network operators for troubleshooting and resource planning to provide a more meaningful alternative to average utilization values Think of a network speedometer

Current Practice coarse averages are collected and exported by routers meaning of averages depends on the interval being used common intervals on the order of minutes hide traffic characteristics packet level time scale: a link is either idle or busy

What to measure? Proactive approach: How much bandwidth is available for additional traffic of a certain profile? Reactive approach: What happens to my packets? Delay, Jitter  caused by long router queues  which in turn are caused by and cause packet bursts If we know all about bursts, then we know all about the traffic and the router’s problems.

Each Packet Needs its Gap Proactive: (potential) traffic needs idle intervals (gaps) Reactive: gaps are the opposite of bursts characterize their distribution in a meaningful way Problem: there are as many gaps as packets  aggregation and visualization

Aggregation and Visualization: Histograms... of gap lengths calculated over short intervals (  1 second)  provide a lot of information about traffic profile Problem: How to visualize progression of time? Solution: 3-D plots  poor readability  unsuitable for real-time measurements display sequence of histograms (movie)

University of Leipzig Internet access link :00 black:relative number of gaps blue:cumulated number of gaps (CDF) Live Snapshot compare the information density with a single average per second!

3-D Offline Visualization

two similarly loaded links University of Erlangen, Germany vs. National Center of Atmospheric Research, Boulder, CO, USA NCAR is a lot more bursty!!! Comparison Example

Example: A Busy Link gaps become shorter  scale gap axis

Future work How does a curve correspond to the current QoS? What was the delay at the upstream router? What is the expected jitter of my VoIP traffic? How does a curve describe the available bandwidth? How many VoIP connections still fit in? What is the best way to capture long-term trends? use floor and cap curves for ressource planning What about intrusion detection? use the histogram shape as a fingerprint

Thank you!